How do attackers use anti-forensic tools to misdirect an investigation?

What is the significance of the 4th Amendment to a forensic investigation? If you are a corporation, what is the best way to ensure that users waive any expectation of privacy when using their computers?

Discuss why a live analysis is preferred over a “dead” analysis and the issue of “volatility”. In an investigation, what information would need to be captured first?